tinyhmacmd5 0.0.7 → 0.1.1

package/README.md

@@ -2,10 +2,14 @@
 
 A tiny JavaScript HMAC-MD5 implementation.
 
-The minified browser bundle ([`browser.min.js`](browser.min.js)) is only 965 bytes.
+The minified browser bundle ([`browser.min.js`](browser.min.js)) is only 1057 bytes.
 
 Preview: https://bddjr.github.io/tinyhmacmd5/
 
+> [!WARNING]  
+> MD5 is cryptographically broken and unsafe for security-sensitive applications.  
+> Do not rely on it for password hashing, digital signatures, or certificate verification.
+
 ## Setup
 
 ### npm
@@ -30,6 +34,10 @@ See https://www.jsdelivr.com/package/npm/tinyhmacmd5
 
 ## Example
 
+> [!WARNING]  
+> Please make sure on your own that the types of input parameters conform to the definitions in [`main.d.ts`](main.d.ts).  
+> If you pass wrong types, it may not throw an error and may produce incorrect results.
+
 HMAC-MD5:
 
 ```js

package/browser.min.js

@@ -1,2 +1,2 @@
 /** @license https://bddjr.github.io/tinyhmacmd5/lic */
-{let r=1732584193,e=271733878,t=~r,n=~e,o=[],f=(f,a,h=0,i,l,u,d,c,g=[r,n,t,e],s=[...g],y=r=>g[3&++c])=>{for(f[a+64>>>9<<4|14]=0|a,f[a>>>5]|=128<<a%32;h<f.length;h+=16){for(c=i=0;i<64;c-=6)g[3&c]=0|((l=0|(l=y(),u=y(),d=y(),((a=i>>4<<2)?a>4?a>8?u^(l|~d):l^u^d:l&d|u&~d:l&u|~l&d)+(0|f[h+(i*(29521>>a)+(1296>>a)&15)])+(u="',16%).4$+07&*/5".charCodeAt(a+i%4)-32,o[63-i++]??=0|2**32*Math.abs(Math.sin(i)))+y()))<<u|l>>>32-u)+y();for(c=4;c;)s[--c]=g[c]=0|s[c]+g[c]}return g},a=(r,e,t=("string"==typeof r?r=(new TextEncoder).encode(r):r).length,n=[],o=8*t)=>{for(;t;)n[e+(--t>>>2)]|=r[t]<<t%4*8;return[n,o]};var md5=(r,e,t)=>{var n=16,o=null!=e,[h,i]=a(r,o*n),l=new Uint8Array(n);if(o){let[r,t]=a(e,0),o=e=>{for(;n;)h[--n]=16843009*e^r[n];n=16};t>512&&(r=f(r,t)),o(54),(h=f(h,512+i)).unshift(...Array(16)),o(92),i=640}for(h=f(h,i);n;)l[--n]=h[n>>2]>>>n%4*8;return t?l:l.reduce((r,e)=>r+(e>>4&&"")+e.toString(16),"")}}
+{let r=1732584193,e=271733878,n=~r,t=~e,o=2**32,f=Math,a=f.floor,l=r=>16*a((r+8)/64)+16,i=[],u=(u,d,h=0,c=l(d),g,s,w,y,A=[r,t,n,e],v=[...A])=>{for(u[c-1]=0|8*d/o,u[c-2]=0|8*d,u[a(d/4)]|=128<<d%4*8;h<u.length;h+=16){for(y=c=0;c<64;)A[3&y]=0|((g=0|(g=A[3&++y],s=A[3&++y],w=A[3&++y],((d=c>>4<<2)?d>4?d>8?s^(g|~w):g^s^w:g&w|s&~w:g&s|~g&w)+(0|u[h+(c*(29521>>d)+(1296>>d)&15)])+(s=31&"',16%).4$+07&*/5".charCodeAt(d+c%4),i[63-c++]??=0|o*f.abs(f.sin(c)))+A[y+1&3]))<<s|g>>>32-s)+A[y+2&3];for(y=4;y;)v[--y]=A[y]=0|v[y]+A[y]}return A},d=(r,e,n=("string"==typeof r?r=(new TextEncoder).encode(r):r).length,t=new Int32Array(l(4*e+n)),o=0)=>{for(;o<n;)t[e++]=r[o++]|r[o++]<<8|r[o++]<<16|r[o++]<<24;return[t,n]};var md5=(r,e,n)=>{var t=16,o=null!=e,[f,a]=d(r,o*t),l=new Uint8Array(t);if(o){let[r,n]=d(e,0),o=[];for(n>64&&(r=u(r,n));t;)f[--t]=909522486^r[t],o[t]=1549556828^r[t];t=16,(f=u(f,64+a)).unshift(...o),a=80}for(f=u(f,a);t;)l[--t]=f[t>>2]>>>t%4*8;return n?l:l.reduce((r,e)=>r+(e>>4&&"")+e.toString(16),"")}}

package/main.d.ts

@@ -4,13 +4,21 @@
  * By default, returns the hash as a lowercase hexadecimal string.  
  * If `raw` is true, returns a Uint8Array.  
  *
- * @param {string | Uint8Array} data The input data to hash. Strings are UTF‑8 encoded.
- * @param {string | Uint8Array | null} [key] Optional HMAC key. When given, HMAC‑MD5 is calculated instead of plain MD5.
+ * @param {string | Uint8Array | Uint8ClampedArray} data The input data to hash. Strings are UTF‑8 encoded.
+ * @param {string | Uint8Array | Uint8ClampedArray | null} [key] Optional HMAC key. When given, HMAC‑MD5 is calculated instead of plain MD5.
  * @param {boolean} [raw] If true, the hash is returned as raw bytes (Uint8Array); otherwise, as a hex string.
  * @returns {string | Uint8Array<ArrayBuffer>} The MD5 (or HMAC‑MD5) digest, either as a hex string or a Uint8Array.
  */
 declare var md5: {
-    (data: string | Uint8Array, key?: string | Uint8Array | null, raw?: false): string;
-    (data: string | Uint8Array, key: string | Uint8Array | null | undefined, raw: true): Uint8Array<ArrayBuffer>;
+    (
+        data: string | Uint8Array | Uint8ClampedArray,
+        key?: string | Uint8Array | Uint8ClampedArray | null,
+        raw?: false
+    ): string;
+    (
+        data: string | Uint8Array | Uint8ClampedArray,
+        key: string | Uint8Array | Uint8ClampedArray | null | undefined,
+        raw: true
+    ): Uint8Array<ArrayBuffer>;
 };
 export default md5;

package/main.js

@@ -7,14 +7,23 @@ let A = 1732584193
   , C = ~A
   , B = ~D
 
+let $2_32 = 2 ** 32
+
+let $Math = Math
+
+let floor = $Math.floor
+
+/** @param {number} byteLen */
+let toBinlLen = (byteLen) => floor((byteLen + 8) / 64) * 16 + 16
+
 /** @type {number[]} MD5 constants cached in memory */
 let K = []
 
 /**
  * Calculate the MD5 of an array of little-endian words, and a bit length.
  *
- * @param {number[]} x Array of little-endian words
- * @param {number} l Bit length
+ * @param {Int32Array | number[]} x Array of little-endian words
+ * @param {number} l Byte length
  * 
  * @param {number} [j]
  * @param {number} [t0]
@@ -29,31 +38,29 @@ let binlMD5 = (
   l,
   // var:
   i = 0,
-  j,
+  j = toBinlLen(l),
   t0,
   t1,
   t2,
   oi,
   output = [A, B, C, D],
   oldOutput = [...output],
-  o = (
-    /** @param {*} [_] */
-    _ => output[++oi & 3]
-  ),
 ) => {
+  // console.time("binlMD5")
 
   // append padding
-  x[l + 64 >>> 9 << 4 | 14] = 0 | l;
-  x[l >>> 5] |= 0x80 << l % 32;
+  x[j - 1] = 0 | l * 8 / $2_32;
+  x[j - 2] = 0 | l * 8;
+  x[floor(l / 4)] |= 0x80 << l % 4 * 8;
 
   for (; i < x.length; i += 16) {
-    for (oi = j = 0; j < 64; oi -= 6) {
+    for (oi = j = 0; j < 64;) {
       output[oi & 3] = (
         t0 = 0 | (
           (
-            t0 = o(),
-            t1 = o(),
-            t2 = o(),
+            t0 = output[++oi & 3],
+            t1 = output[++oi & 3],
+            t2 = output[++oi & 3],
             (l = j >> 4 << 2)
               ? l > 4
                 ? l > 8
@@ -66,60 +73,67 @@ let binlMD5 = (
             0 | x[i + (j * (0x7351 >> l) + (0x0510 >> l) & 15)]
           ) +
           (
-            t1 = "',16%).4$+07&*/5".charCodeAt(l + j % 4) - 32,
-            K[63 - j++] ??= 0 | 2 ** 32 * Math.abs(Math.sin(j))
+            t1 = "',16%).4$+07&*/5".charCodeAt(l + j % 4) & 31,
+            K[63 - j++] ??= 0 | $2_32 * $Math.abs($Math.sin(j))
           ) +
-          o()
+          output[oi + 1 & 3]
         ),
-        0 | (t0 << t1 | t0 >>> 32 - t1) + o()
+        0 | (t0 << t1 | t0 >>> 32 - t1) + output[oi + 2 & 3]
       )
     }
     for (oi = 4; oi;) {
       oldOutput[--oi] = output[oi] = 0 | oldOutput[oi] + output[oi]
     }
   }
+  // console.timeEnd("binlMD5")
   return output
 }
 
 /**
  * Convert bytes to an array of little-endian words
  *
- * @param {string | Uint8Array} input
- * @param {number} padLen
+ * @param {*} input
+ * @param {number} j pad int32 length
  * 
- * @param {number[]} [output]
- * 
- * @returns {[number[], number]}
+ * @returns {[Int32Array<ArrayBuffer> | number[], number]}
  */
 let inputToBinl = (
   input,
-  padLen,
+  j,
   // var:
-  i = (
+  byteLen = (
     typeof input == 'string'
       ? input = new TextEncoder().encode(input)
       : input
   ).length,
-  output = [],
-  bitLen = 8 * i,
+  // Using Array would fail to handle large files, so Int32Array must be used.
+  output = new Int32Array(toBinlLen(j * 4 + byteLen)),
+  i = 0,
 ) => {
-  for (; i;) {
-    output[padLen + (--i >>> 2)] |= /**@type {Uint8Array}*/(input)[i] << i % 4 * 8
+  // console.time("inputToBinl")
+  for (; i < byteLen;) {
+    output[j++] = (
+      input[i++] |
+      input[i++] << 8 |
+      input[i++] << 16 |
+      input[i++] << 24
+    )
   }
-  return [output, bitLen]
+  // console.timeEnd("inputToBinl")
+  return [output, byteLen]
 }
 
 /**
  * @overload
- * @param {string | Uint8Array} data
- * @param {string | Uint8Array | null} [key]
+ * @param {string | Uint8Array | Uint8ClampedArray} data
+ * @param {string | Uint8Array | Uint8ClampedArray | null} [key]
  * @param {false} [raw]
  * @returns {string}
  */
 /**
  * @overload
- * @param {string | Uint8Array} data
- * @param {string | Uint8Array | null | undefined} key
+ * @param {string | Uint8Array | Uint8ClampedArray} data
+ * @param {string | Uint8Array | Uint8ClampedArray | null | undefined} key
  * @param {true} raw
  * @returns {Uint8Array<ArrayBuffer>}
  */
@@ -129,37 +143,35 @@ let inputToBinl = (
  * By default, returns the hash as a lowercase hexadecimal string.  
  * If `raw` is true, returns a Uint8Array.  
  *
- * @param {string | Uint8Array} data The input data to hash. Strings are UTF‑8 encoded.
- * @param {string | Uint8Array | null} [key] Optional HMAC key. When given, HMAC‑MD5 is calculated instead of plain MD5.
+ * @param {string | Uint8Array | Uint8ClampedArray} data The input data to hash. Strings are UTF‑8 encoded.
+ * @param {string | Uint8Array | Uint8ClampedArray | null} [key] Optional HMAC key. When given, HMAC‑MD5 is calculated instead of plain MD5.
  * @param {boolean} [raw] If true, the hash is returned as raw bytes (Uint8Array); otherwise, as a hex string.
  * @returns {string | Uint8Array<ArrayBuffer>} The MD5 (or HMAC‑MD5) digest, either as a hex string or a Uint8Array.
  */
 var md5 = (data, key, raw) => {
   var i = 16
     , hasKey = key != null
-    , [bdata, bitLen] = inputToBinl(data, /**@type {*}*/(hasKey) * i)
+    , [bdata, dataByteLen] = inputToBinl(data, /**@type {*}*/(hasKey) * i)
     , out = new Uint8Array(i)
 
   if (hasKey) {
     // HMAC
-    let [bkey, keyBitlen] = inputToBinl(key, 0)
-      , pad = (/**@type {number}*/ x) => {
-        for (; i;) {
-          bdata[--i] = 0x01010101 * x ^ bkey[i]
-        }
-        i = 16
-      }
-    if (keyBitlen > 512) {
-      bkey = binlMD5(bkey, keyBitlen)
+    let [bkey, keyByteLen] = inputToBinl(key, 0)
+    let opad = []
+    if (keyByteLen > 64) {
+      bkey = binlMD5(bkey, keyByteLen)
+    }
+    for (; i;) {
+      bdata[--i] = 0x36363636 ^ bkey[i] // ipad
+      opad[i] = 0x5c5c5c5c ^ bkey[i]
     }
-    pad(0x36)
-    bdata = binlMD5(bdata, 512 + bitLen)
-    bdata.unshift(...Array(16))
-    pad(0x5c)
-    bitLen = 640
+    i = 16
+    bdata = binlMD5(bdata, 64 + dataByteLen)
+    bdata.unshift(...opad)
+    dataByteLen = 80
   }
 
-  bdata = binlMD5(bdata, bitLen)
+  bdata = binlMD5(bdata, dataByteLen)
 
   // binl to bytes
   for (; i;) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tinyhmacmd5",
-  "version": "0.0.7",
-  "description": "A tiny JavaScript HMAC-MD5 implementation. The minified browser bundle is only 965 bytes.",
+  "version": "0.1.1",
+  "description": "A tiny JavaScript HMAC-MD5 implementation. The minified browser bundle is only 1057 bytes.",
   "author": "bddjr",
   "license": "MIT",
   "type": "module",